P4T12ICK d8e090d496 wip

2020-11-11 16:27:14 +01:00

..

clients_connecting_to_multiple_dns_servers.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

detect_arp_poisoning.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

detect_hosts_connecting_to_dynamic_domain_providers.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

detect_large_outbound_icmp_packets.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

detect_long_dns_txt_record_response.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

detect_outbound_smb_traffic.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

detect_rogue_dhcp_server.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

detect_unauthorized_assets_by_mac_address.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

detect_windows_dns_sigred_via_splunk_stream.yml

wip

2020-11-11 16:27:14 +01:00

detect_windows_dns_sigred_via_zeek.yml

wip

2020-11-11 16:27:14 +01:00

detect_zerologon_via_zeek.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

detection_of_dns_tunnels.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

dns_query_length_outliers___mltk.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

dns_query_length_with_high_standard_deviation.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

dns_query_requests_resolved_by_unauthorized_dns_servers.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

dns_record_changed.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

excessive_dns_failures.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

hosts_receiving_high_volume_of_network_traffic_from_email_server.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

large_volume_of_dns_any_queries.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

monitor_dns_for_brand_abuse.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

prohibited_network_traffic_allowed.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

protocol_or_port_mismatch.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

protocols_passing_authentication_in_cleartext.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

remote_desktop_network_bruteforce.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

remote_desktop_network_traffic.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

smb_traffic_spike___mltk.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

smb_traffic_spike.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

tor_traffic.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00